NDLI: Anomaly detection and visualization using Fisher Discriminant clustering of network entropy

Content Provider	IEEE Xplore Digital Library
Author	Celenk, M. Conley, T. Willis, J. Graham, J.
Copyright Year	2008
Description	Author affiliation: Sch. of Electr. Eng. & Comput. Sci., Ohio Univ., Athens, OH (Celenk, M.; Conley, T.; Willis, J.; Graham, J.)
Abstract	Entropy has been widely used to quantify information for display and examination in determining network status and in detecting anomalies. Although entropy-based methods are effective, they rely on long-term network statistics. Here, we propose an approach that deduces short term observations of network features and their respective time averaged entropies. Acute changes are detected in network feature space and depicted in a visually compact information graph. First, average entropy for each feature is calculated for every second of observation. Then, the resultant short-term information measurement is subjected to first- and second-order time averaging statistics. These time-varying statistics are used as the basis of a novel approach to anomaly estimation based on the well-known Fisher linear discriminant (FLD). This process then initiates stochastic clustering to identify the exact time of the security incident or attack on the network. The proposed method is tested on real-time network traffic data collected from Ohio Universitypsilas main Internet connection. Experimentation has shown that the presented FLD based method is accurate in identifying anomalies in network feature space. Furthermore, itpsilas performance is highly robust in the presence of bursty network traffic and it is able to detect network anomalies such as BotNet, worm outbreaks, and denial of service attacks.
Starting Page	216
Ending Page	220
File Size	699516
Page Count	5
File Format	PDF
ISBN	9781424429165
DOI	10.1109/ICDIM.2008.4746810
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-11-13
Publisher Place	UK
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Visualization Computer vision Data security Stochastic processes Information security Telecommunication traffic Displays Entropy Time measurement Statistics
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Predictive Network Anomaly Detection and Visualization

F-TAD: Traffic Anomaly Detection for Sub-networks Using Fisher Linear Discriminant

Three levels network analysis for anomaly detection

Using Random Forests for Network-based Anomaly detection at Active routers

An Unsupervised Anomaly Detection Approach using Subtractive Clustering and Hidden Markov Model

Anomaly Detection in network traffic and role of wavelets

Visual correlation of host processes and network traffic

Visualization and Explanation of Payload-Based Anomaly Detection

A Network Anomaly Detection Method Based on Relative Entropy Theory

Anomaly detection and visualization using Fisher Discriminant clustering of network entropy

Similar Documents

Predictive Network Anomaly Detection and Visualization

F-TAD: Traffic Anomaly Detection for Sub-networks Using Fisher Linear Discriminant

Three levels network analysis for anomaly detection

Using Random Forests for Network-based Anomaly detection at Active routers

An Unsupervised Anomaly Detection Approach using Subtractive Clustering and Hidden Markov Model

Anomaly Detection in network traffic and role of wavelets

Visual correlation of host processes and network traffic

Visualization and Explanation of Payload-Based Anomaly Detection

A Network Anomaly Detection Method Based on Relative Entropy Theory

Anomaly detection and visualization using Fisher Discriminant clustering of network entropy